1CO. 


Information Commissioner’s Office 


ICO right to review scheme for victims of 


crime 


This document describes the ICO scheme that gives victims of crime the 
right to ask us to review a decision. 


Definitions and scope of the scheme 


Victim: a person who has suffered harm, including physical, mental or 
emotional harm or economic loss which was directly caused by a criminal 


offence. 


This definition can include close family members, where the victim is a 
minor. We will also include businesses where there is an identifiable 
person who can represent the business. In data protection offences, this 
will often be the data controller. 


Crime: Where a criminal offence has occurred. The main criminal offences 
investigated and prosecuted by the ICO are: 


(i) 


(iii) 


(iv) 
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Unlawfully obtaining data - Section 170 of the Data Protection 
Act (DPA) 2018 (N.B. this offence is formerly section 55 of the 
Data Protection Act 1998). The victim is likely to be the data 
controller whose data has been unlawfully obtained, procured, 
disclosed or sold, as well as the data subject whose data is 
involved in the offence, subject to them having suffered some 
type of harm or economic loss as a direct result; 

Altering records to prevent disclosure - Section 77 of the 
Freedom of Information Act (FOIA) 2000 or section 173 of the 
DPA 2018. The victim will usually be the requestor of the 
information which has been unlawfully altered or destroyed; 
Re-identification of de-identified personal data - Section 171 
of the DPA 2018. The victim is likely to be the data controller 
whose data has been unlawfully de-identified, as well as the 
data subject whose data is involved in the offence, if they 
have suffered some type of harm or economic loss as a result; 
Enforced subject access/requirement to produce relevant 
records - section 184 of the DPA 2018. The victim is likely to 


be the data subject who was required to produce a relevant 
record. 


These examples are not exhaustive. 
The scheme applies to the following decisions, where they qualify: 


- A decision by an investigator not to investigate a complaint either at 
all or not to investigate a complaint any further; 

- A decision by a prosecutor not to prosecute or to not continue with 
a prosecution, either by making a decision to discontinue, withdraw, 
offer no evidence or for charges to lie on the file. 


This scheme applies to qualifying decisions made on or after 16 November 
2015. 


How the scheme works 


If an ICO investigator or prosecutor makes a decision that qualifies under 
the scheme, they write to victims with information about how to make a 
request. 


The information includes: 


- the decision that has been made, eg not to investigate or 
prosecute; 

- brief reasons for the decision, for example whether it was on 
evidential or public interest grounds; 

- how to find out more information about the decision if they wish; 
and 

- details of the scheme and how to request a review. 


We also inform victims that they have three months to make their 
request, from the date we wrote to them. We refuse any requests made 
after three months, unless there are exceptional circumstances. 


We encourage victims to make requests early if possible, to help us 
conduct the review promptly and minimise delay if we need to reinstate 
our investigation or proceedings. 


When we receive a request, an investigator, prosecutor or manager 
reviews the original case, provided that they are sufficiently independent 
and in a position to do so. If necessary, we may seek external advice. 


The reviewer confirms whether or not it the original decision was correct 
and reasonable. 
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The review may result in the decision being overturned. If so, we 
reinstate our investigation or proceedings and notify the victim, providing 
that is still possible, for example the offence is not time barred such as 
S77 FOIA 2000. 


Or, the review may result in the original decision being upheld. If that is 
the case the reviewer considers whether the original decision was 
sufficient, and provide further explanation or information if that would 
help the victim understand the decision. 


We aim to conduct the review and communicate the outcome to the 
victim within 30 calendar days of receiving notice of the request to 
review. If the case is particularly complex and we cannot complete the 
review in time then we inform the victim. Should the offence be at risk of 
becoming time barred then we expedite the review with the aim of 
completing it before the expiry of the time period for commencing a 
prosecution. 


We communicate the outcome of the review by phone or face-to-face in 
cases where victims might be vulnerable, intimidated or persistently 
targeted. 


If the victim remains dissatisfied with the outcome following a review 
under this scheme, the victim would need to consider a judicial review. 


Background 


The EU Victims' Directive was adopted in 2012 and all EU Member States 
were to transpose the Directive by November 2015. The aim of the 
Directive was to promote improved standards on the entitlements, 
support and protection available to victims of crime across the EU. Article 
11 of the Victims’ Directive expresses the right for a victim to have a 
decision not to prosecute reviewed. 


A Victim’s Right to Review (VRR) scheme is also included in the revised 
Victims Code, published in October 2015. The ICO is listed as one of the 
organisations within the Code who must have regard to it. 


In light of the developments in this area, outlined above, this ICO scheme 
aims to give effect to requirements of the Victims’ Directive and Victims 
Code, for victims to request that a decision is reviewed. 
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Exclusions 
This scheme does not apply to decisions made before 16 November 2015. 


This scheme applies to victims of a criminal offence and does not apply to 
cases where we are investigating civil (non-criminal) breaches. 


The scheme provides for a right that the qualifying decision is reviewed, it 
is not a right for the decision to be overturned, so there is no guarantee 
of a review resulting in a different outcome. 


The scheme does not apply where the cases are concluded by way of use 
of an out of court disposal, such as the acceptance of a formal caution or 
by way of other regulatory action available to the Commissioner, such as 
an undertaking. 


The scheme does also not apply where, whilst the complaint of the 
particular victim may not be proceeding further, other action is taken in 
respect of complaints arising out of the same investigation or against the 
Same suspects. 


Where victims are considering a judicial review against the ICO for a 
decision falling within the scope of this scheme, the courts are likely to 
expect that victims would have requested a review under the scheme 
first. 


We do not actively inform suspects or defendants of a request made 
under this scheme, unless a decision is made to overturn the original 
decision. We do, however, inform suspects and defendants of the scheme. 
Should a victim be dissatisfied about a decision that falls outside the 
scope of this scheme, the victim can still make a complaint under the 
1CO’s complaint process. 
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